src/
  ├── controllers/    # 请求处理层
  │   ├── base.controller.ts
  │   └── user.controller.ts
  ├── services/      # 业务逻辑层
  │   ├── base.service.ts
  │   └── user.service.ts
  ├── repositories/  # 数据访问层
  │   ├── base.repository.ts
  │   └── user.repository.ts
  ├── domain/       # 领域模型层
  │   ├── entities/
  │   └── value-objects/
  └── infrastructure/ # 基础设施层
      ├── database/
      ├── cache/
      └── queue/

// 1. URL 主版本
/api/v1/users

// 2. Accept Header 次版本
Accept: application/vnd.api.v1.1+json

// 3. 字段版本控制
{
  "data": {
    "id": "123",
    "name_v2": "John Doe",  // 新版本字段
    "name": "John Doe"      // 向后兼容
  }
}

// errors/base.error.ts
export class AppError extends Error {
  constructor(
    public statusCode: number,
    public code: string,
    message: string,
    public details?: unknown,
    public operational = true
  ) {
    super(message);
    Error.captureStackTrace(this, this.constructor);
  }
}

// errors/application-errors.ts
export class ValidationError extends AppError {
  constructor(message: string, details?: unknown) {
    super(400, 'VALIDATION_ERROR', message, details);
  }
}

export class NotFoundError extends AppError {
  constructor(resource: string) {
    super(404, 'NOT_FOUND', `${resource} not found`);
  }
}

// middleware/error-handler.ts
export function errorHandler(err: Error, req: Request, res: Response, next: NextFunction) {
  if (err instanceof AppError) {
    // 操作型错误 - 可预期的错误
    logger.warn({
      code: err.code,
      message: err.message,
      details: err.details,
      stack: err.stack,
    });

    return res.status(err.statusCode).json({
      error: {
        code: err.code,
        message: err.message,
        details: err.details,
      },
    });
  }

  // 程序型错误 - 未预期的错误
  logger.error({
    error: err,
    stack: err.stack,
  });

  // 通知监控系统
  notifyMonitoring(err);

  res.status(500).json({
    error: {
      code: 'INTERNAL_ERROR',
      message: 'An unexpected error occurred',
    },
  });
}

// services/cache.service.ts
export class CacheService {
  constructor(
    private readonly redis: Redis,
    private readonly memcached: Memcached
  ) {}

  async get<T>(key: string): Promise<T | null> {
    // 1. 检查本地内存缓存
    const localCache = await this.memcached.get(key);
    if (localCache) return localCache;

    // 2. 检查分布式缓存
    const redisCache = await this.redis.get(key);
    if (redisCache) {
      // 回填本地缓存
      await this.memcached.set(key, redisCache, 60);
      return redisCache;
    }

    return null;
  }

  async set(key: string, value: any, ttl: number): Promise<void> {
    // 同时更新两级缓存
    await Promise.all([
      this.redis.set(key, value, 'EX', ttl),
      this.memcached.set(key, value, 60) // 本地缓存时间短一些
    ]);
  }
}

// repositories/base.repository.ts
export class BaseRepository<T> {
  async find(query: QueryOptions): Promise<T[]> {
    const cacheKey = this.generateCacheKey(query);
    const cached = await this.cacheService.get<T[]>(cacheKey);

    if (cached) {
      return cached;
    }

    const result = await this.executeQuery(query);
    
    // 只缓存简单查询的结果
    if (this.isCacheable(query)) {
      await this.cacheService.set(cacheKey, result, 300); // 5分钟
    }

    return result;
  }

  private isCacheable(query: QueryOptions): boolean {
    // 复杂查询不缓存
    return !query.fullTextSearch && !query.complexJoins;
  }
}

// middleware/validation-chain.ts
export function createValidationChain(schema: ZodSchema) {
  return [
    // 1. 基础清理
    sanitizeRequest,
    
    // 2. Schema 验证
    validateSchema(schema),
    
    // 3. 业务规则验证
    validateBusinessRules,
    
    // 4. 数据一致性验证
    validateDataConsistency,
  ];
}

// Usage in routes
router.post(
  '/users',
  createValidationChain(createUserSchema),
  userController.create
);

// middleware/auth.ts
export function authenticate(config: AuthConfig = {}) {
  return async (req: Request, res: Response, next: NextFunction) => {
    try {
      // 1. 提取凭证
      const token = extractToken(req);
      
      // 2. 验证令牌
      const decoded = await verifyToken(token);
      
      // 3. 检查令牌是否被吊销
      await checkTokenRevocation(token);
      
      // 4. 加载用户信息
      const user = await loadUser(decoded.sub);
      
      // 5. 检查用户状态
      if (!isUserActive(user)) {
        throw new AuthenticationError('User account is not active');
      }
      
      // 6. 检查IP限制
      if (!isIpAllowed(req.ip, user.allowedIps)) {
        throw new AuthenticationError('Access from this IP is not allowed');
      }
      
      // 7. 设置用户上下文
      req.user = user;
      
      // 8. 刷新令牌（如果需要）
      await refreshTokenIfNeeded(req, res, token);
      
      next();
    } catch (error) {
      next(new AuthenticationError('Authentication failed'));
    }
  };
}

// middleware/tracer.ts
export function trace(req: Request, res: Response, next: NextFunction) {
  const traceId = req.header('X-Trace-ID') || uuid();
  const spanId = uuid();
  
  req.context = {
    traceId,
    spanId,
    startTime: Date.now(),
  };

  res.on('finish', () => {
    const duration = Date.now() - req.context.startTime;
    
    logger.info({
      type: 'request',
      traceId,
      spanId,
      method: req.method,
      path: req.path,
      status: res.statusCode,
      duration,
      userAgent: req.header('user-agent'),
      ip: req.ip,
    });
  });

  next();
}

// middleware/metrics.ts
export function collectMetrics(req: Request, res: Response, next: NextFunction) {
  const startTime = process.hrtime();
  
  res.on('finish', () => {
    const [seconds, nanoseconds] = process.hrtime(startTime);
    const duration = seconds * 1000 + nanoseconds / 1000000;
    
    metrics.histogram('http_request_duration_ms', duration, {
      method: req.method,
      path: req.route?.path || 'unknown',
      status: res.statusCode.toString(),
    });
    
    metrics.increment('http_requests_total', {
      method: req.method,
      path: req.route?.path || 'unknown',
      status: res.statusCode.toString(),
    });
  });

  next();
}

// tests/unit/services/user.service.test.ts
describe('UserService', () => {
  describe('createUser', () => {
    it('should hash password before saving', async () => {
      const service = new UserService(mockRepo);
      const result = await service.createUser({
        email: 'test@example.com',
        password: 'password123',
      });
      
      expect(result.password).not.toBe('password123');
      expect(result.password).toMatch(/^\$2[aby]?\$\d{1,2}\$[.\/A-Za-z0-9]{53}$/);
    });
  });
});

// tests/integration/api/users.test.ts
describe('Users API', () => {
  describe('POST /api/v1/users', () => {
    it('should create user and return 201', async () => {
      const response = await request(app)
        .post('/api/v1/users')
        .send({
          email: 'test@example.com',
          password: 'password123',
        });
      
      expect(response.status).toBe(201);
      expect(response.body.data).toHaveProperty('id');
    });
  });
});

// routes/health.ts
router.get('/health', async (req, res) => {
  const checks = await Promise.all([
    checkDatabase(),
    checkRedis(),
    checkExternalServices(),
  ]);

  const status = checks.every(check => check.status === 'ok') ? 200 : 503;

  res.status(status).json({
    status: status === 200 ? 'healthy' : 'unhealthy',
    timestamp: new Date().toISOString(),
    checks,
    version: process.env.APP_VERSION,
  });
});

// server.ts
const server = app.listen(port);

async function shutdown() {
  console.log('Received shutdown signal');
  
  // 1. 停止接收新请求
  server.close(() => {
    console.log('Server closed');
  });

  // 2. 等待现有请求完成
  await waitForRequestsToComplete();

  // 3. 关闭数据库连接
  await db.end();
  
  // 4. 关闭缓存连接
  await cache.quit();
  
  // 5. 清理其他资源
  await cleanup();

  process.exit(0);
}

process.on('SIGTERM', shutdown);
process.on('SIGINT', shutdown);

// 项目结构
src/
  ├── config/           # 配置
  ├── controllers/      # 控制器
  ├── services/         # 服务层
  ├── repositories/     # 数据访问层
  ├── domain/          # 领域模型
  │   ├── entities/    # 实体
  │   └── interfaces/  # 接口定义
  ├── infrastructure/  # 基础设施
  │   ├── database/    # 数据库
  │   ├── cache/       # 缓存
  │   └── queue/       # 消息队列
  ├── middleware/      # 中间件
  ├── utils/           # 工具函数
  ├── routes/          # 路由定义
  └── types/           # 类型定义

// config/index.ts
import { z } from 'zod';
import dotenv from 'dotenv';

dotenv.config();

const configSchema = z.object({
  app: z.object({
    name: z.string().default('modern-api'),
    env: z.enum(['development', 'test', 'production']).default('development'),
    port: z.number().default(3000),
    apiPrefix: z.string().default('/api/v1'),
  }),
  db: z.object({
    host: z.string().default('localhost'),
    port: z.number().default(5432),
    username: z.string(),
    password: z.string(),
    database: z.string(),
    maxConnections: z.number().default(20),
    idleTimeout: z.number().default(30000),
  }),
  redis: z.object({
    host: z.string().default('localhost'),
    port: z.number().default(6379),
    password: z.string().optional(),
    db: z.number().default(0),
  }),
  auth: z.object({
    jwtSecret: z.string(),
    jwtExpiresIn: z.string().default('1h'),
    refreshTokenExpiresIn: z.string().default('7d'),
  }),
  cors: z.object({
    origins: z.array(z.string()).default(['*']),
    methods: z.array(z.string()).default(['GET', 'POST', 'PUT', 'DELETE', 'PATCH']),
  }),
  rateLimit: z.object({
    windowMs: z.number().default(15 * 60 * 1000), // 15 minutes
    max: z.number().default(100), // Limit each IP to 100 requests per windowMs
  }),
  logging: z.object({
    level: z.enum(['error', 'warn', 'info', 'debug']).default('info'),
    prettify: z.boolean().default(false),
  }),
  monitoring: z.object({
    enabled: z.boolean().default(true),
    metricsPath: z.string().default('/metrics'),
  }),
});

type Config = z.infer<typeof configSchema>;

function loadConfig(): Config {
  try {
    return configSchema.parse({
      app: {
        name: process.env.APP_NAME,
        env: process.env.NODE_ENV,
        port: process.env.PORT ? parseInt(process.env.PORT, 10) : undefined,
        apiPrefix: process.env.API_PREFIX,
      },
      db: {
        host: process.env.DB_HOST,
        port: process.env.DB_PORT ? parseInt(process.env.DB_PORT, 10) : undefined,
        username: process.env.DB_USERNAME,
        password: process.env.DB_PASSWORD,
        database: process.env.DB_DATABASE,
        maxConnections: process.env.DB_MAX_CONNECTIONS ? 
          parseInt(process.env.DB_MAX_CONNECTIONS, 10) : undefined,
        idleTimeout: process.env.DB_IDLE_TIMEOUT ?
          parseInt(process.env.DB_IDLE_TIMEOUT, 10) : undefined,
      },
      redis: {
        host: process.env.REDIS_HOST,
        port: process.env.REDIS_PORT ? parseInt(process.env.REDIS_PORT, 10) : undefined,
        password: process.env.REDIS_PASSWORD,
        db: process.env.REDIS_DB ? parseInt(process.env.REDIS_DB, 10) : undefined,
      },
      auth: {
        jwtSecret: process.env.JWT_SECRET!,
        jwtExpiresIn: process.env.JWT_EXPIRES_IN,
        refreshTokenExpiresIn: process.env.REFRESH_TOKEN_EXPIRES_IN,
      },
      cors: {
        origins: process.env.CORS_ORIGINS?.split(','),
        methods: process.env.CORS_METHODS?.split(','),
      },
      rateLimit: {
        windowMs: process.env.RATE_LIMIT_WINDOW_MS ? 
          parseInt(process.env.RATE_LIMIT_WINDOW_MS, 10) : undefined,
        max: process.env.RATE_LIMIT_MAX ? 
          parseInt(process.env.RATE_LIMIT_MAX, 10) : undefined,
      },
      logging: {
        level: process.env.LOG_LEVEL as any,
        prettify: process.env.LOG_PRETTIFY === 'true',
      },
      monitoring: {
        enabled: process.env.MONITORING_ENABLED === 'true',
        metricsPath: process.env.METRICS_PATH,
      },
    });
  } catch (error) {
    console.error('Configuration validation failed:', error);
    process.exit(1);
  }
}

export const config = loadConfig();

// types/global.d.ts
declare global {
  namespace Express {
    interface Request {
      id: string;
      user?: {
        id: string;
        role: string;
        permissions: string[];
      };
      context: {
        traceId: string;
        spanId: string;
        startTime: number;
      };
    }
  }
}

// infrastructure/logger.ts
import pino from 'pino';
import { config } from '../config';

const logger = pino({
  level: config.logging.level,
  transport: config.logging.prettify
    ? {
        target: 'pino-pretty',
        options: {
          colorize: true,
          translateTime: 'HH:MM:ss Z',
          ignore: 'pid,hostname',
        },
      }
    : undefined,
  base: {
    env: config.app.env,
    version: process.env.npm_package_version,
  },
  redact: {
    paths: ['password', 'token', 'authorization', 'cookie'],
    censor: '[REDACTED]',
  },
});

export { logger };

// infrastructure/database/index.ts
import { drizzle } from 'drizzle-orm/node-postgres';
import { Pool } from 'pg';
import { config } from '../../config';
import { logger } from '../logger';

const pool = new Pool({
  host: config.db.host,
  port: config.db.port,
  user: config.db.username,
  password: config.db.password,
  database: config.db.database,
  max: config.db.maxConnections,
  idleTimeoutMillis: config.db.idleTimeout,
  application_name: config.app.name,
});

pool.on('connect', () => {
  logger.debug('New database connection established');
});

pool.on('error', (err) => {
  logger.error('Unexpected error on idle database client', err);
  process.exit(-1);
});

export const db = drizzle(pool);

// infrastructure/cache/index.ts
import { Redis } from 'ioredis';
import { config } from '../../config';
import { logger } from '../logger';

const redis = new Redis({
  host: config.redis.host,
  port: config.redis.port,
  password: config.redis.password,
  db: config.redis.db,
  retryStrategy(times) {
    const delay = Math.min(times * 50, 2000);
    return delay;
  },
  reconnectOnError(err) {
    const targetError = 'READONLY';
    if (err.message.includes(targetError)) {
      return true;
    }
    return false;
  },
});

redis.on('connect', () => {
  logger.debug('Redis client connected');
});

redis.on('error', (err) => {
  logger.error('Redis client error', err);
});

export { redis };

// src/types/error.ts
export interface ErrorResponse {
  error: {
    code: string;
    message: string;
    details?: unknown;
  };
  meta: {
    timestamp: string;
    request_id: string;
    path: string;
  };
}

// src/errors/base.error.ts
export class AppError extends Error {
  constructor(
    public readonly statusCode: number,
    public readonly code: string,
    message: string,
    public readonly details?: unknown,
    public readonly isOperational = true
  ) {
    super(message);
    Error.captureStackTrace(this, this.constructor);
  }
}

// src/errors/application-errors.ts
export class ValidationError extends AppError {
  constructor(message: string, details?: unknown) {
    super(400, 'VALIDATION_ERROR', message, details);
  }
}

export class AuthenticationError extends AppError {
  constructor(message = 'Authentication failed') {
    super(401, 'AUTHENTICATION_ERROR', message);
  }
}

export class AuthorizationError extends AppError {
  constructor(message = 'Permission denied') {
    super(403, 'AUTHORIZATION_ERROR', message);
  }
}

export class NotFoundError extends AppError {
  constructor(resource: string) {
    super(404, 'NOT_FOUND', `${resource} not found`);
  }
}

export class ConflictError extends AppError {
  constructor(message: string) {
    super(409, 'CONFLICT', message);
  }
}

export class RateLimitError extends AppError {
  constructor(message = 'Too many requests') {
    super(429, 'RATE_LIMIT_EXCEEDED', message);
  }
}

// src/middleware/error.ts
import { Request, Response, NextFunction } from 'express';
import { AppError } from '../errors/base.error';
import { logger } from '../infrastructure/logger';
import { config } from '../config';
import { ErrorResponse } from '../types/error';
import { ZodError } from 'zod';

export function errorHandler(
  err: Error,
  req: Request,
  res: Response<ErrorResponse>,
  next: NextFunction
): void {
  logger.error({
    err,
    req: {
      method: req.method,
      url: req.url,
      params: req.params,
      query: req.query,
      body: req.body,
    },
  });

  if (err instanceof AppError) {
    res.status(err.statusCode).json({
      error: {
        code: err.code,
        message: err.message,
        details: err.details,
      },
      meta: {
        timestamp: new Date().toISOString(),
        request_id: req.id,
        path: req.path,
      },
    });
    return;
  }

  if (err instanceof ZodError) {
    res.status(400).json({
      error: {
        code: 'VALIDATION_ERROR',
        message: 'Invalid request data',
        details: err.errors,
      },
      meta: {
        timestamp: new Date().toISOString(),
        request_id: req.id,
        path: req.path,
      },
    });
    return;
  }

  // Handle unexpected errors
  const internalError = {
    error: {
      code: 'INTERNAL_ERROR',
      message: config.app.env === 'production' 
        ? 'An unexpected error occurred' 
        : err.message,
      details: config.app.env === 'production' ? undefined : err.stack,
    },
    meta: {
      timestamp: new Date().toISOString(),
      request_id: req.id,
      path: req.path,
    },
  };

  res.status(500).json(internalError);
}

// src/middleware/request-id.ts
import { Request, Response, NextFunction } from 'express';
import { v4 as uuidv4 } from 'uuid';

export function requestId(req: Request, res: Response, next: NextFunction): void {
  const existingRequestId = req.headers['x-request-id'];
  req.id = (existingRequestId as string) || uuidv4();
  res.setHeader('X-Request-ID', req.id);
  next();
}

// src/middleware/request-context.ts
import { Request, Response, NextFunction } from 'express';
import { v4 as uuidv4 } from 'uuid';
import cls from 'cls-hooked';

const nsid = 'request-context';
export const ns = cls.createNamespace(nsid);

export function requestContext(req: Request, res: Response, next: NextFunction): void {
  ns.run(() => {
    ns.set('traceId', req.id);
    ns.set('spanId', uuidv4());
    ns.set('startTime', Date.now());
    next();
  });
}

// src/middleware/request-logger.ts
import { Request, Response, NextFunction } from 'express';
import { logger } from '../infrastructure/logger';

export function requestLogger(req: Request, res: Response, next: NextFunction): void {
  const startTime = Date.now();
  
  // Log request
  logger.info({
    type: 'request',
    method: req.method,
    url: req.url,
    requestId: req.id,
    userAgent: req.get('user-agent'),
    ip: req.ip,
  });

  // Log response
  res.on('finish', () => {
    const duration = Date.now() - startTime;
    logger.info({
      type: 'response',
      method: req.method,
      url: req.url,
      status: res.statusCode,
      duration,
      requestId: req.id,
    });
  });

  next();
}

// src/middleware/cors.ts
import cors from 'cors';
import { config } from '../config';

export const corsMiddleware = cors({
  origin: (origin, callback) => {
    if (!origin || config.cors.origins.includes('*')) {
      callback(null, true);
      return;
    }
    
    if (config.cors.origins.includes(origin)) {
      callback(null, true);
    } else {
      callback(new Error('Not allowed by CORS'));
    }
  },
  methods: config.cors.methods,
  credentials: true,
  maxAge: 86400, // 24 hours
  exposedHeaders: ['X-Request-ID', 'X-RateLimit-Limit', 'X-RateLimit-Remaining'],
  allowedHeaders: ['Content-Type', 'Authorization', 'X-Request-ID'],
});

// src/middleware/security.ts
import helmet from 'helmet';
import { rateLimit } from 'express-rate-limit';
import { config } from '../config';
import { RateLimitError } from '../errors/application-errors';

export const securityMiddleware = {
  helmet: helmet({
    contentSecurityPolicy: {
      directives: {
        defaultSrc: ["'self'"],
        styleSrc: ["'self'", "'unsafe-inline'"],
        scriptSrc: ["'self'"],
        imgSrc: ["'self'", "data:", "https:"],
      },
    },
    crossOriginEmbedderPolicy: true,
    crossOriginOpenerPolicy: true,
    crossOriginResourcePolicy: true,
    dnsPrefetchControl: true,
    frameguard: true,
    hidePoweredBy: true,
    hsts: true,
    ieNoOpen: true,
    noSniff: true,
    referrerPolicy: true,
    xssFilter: true,
  }),

  rateLimit: rateLimit({
    windowMs: config.rateLimit.windowMs,
    max: config.rateLimit.max,
    standardHeaders: true,
    legacyHeaders: false,
    handler: (req, res, next) => {
      next(new RateLimitError());
    },
    keyGenerator: (req) => {
      return req.header('X-Forwarded-For') || req.ip;
    },
  }),
};

// src/middleware/validation.ts
import { Request, Response, NextFunction } from 'express';
import { ZodSchema } from 'zod';
import { ValidationError } from '../errors/application-errors';

export function validateRequest(schema: ZodSchema) {
  return async (req: Request, res: Response, next: NextFunction): Promise<void> => {
    try {
      await schema.parseAsync({
        body: req.body,
        query: req.query,
        params: req.params,
      });
      next();
    } catch (error) {
      if (error instanceof Error) {
        next(new ValidationError('Validation failed', error));
      } else {
        next(error);
      }
    }
  };
}

// src/middleware/async-handler.ts
import { Request, Response, NextFunction } from 'express';

type AsyncRequestHandler = (
  req: Request,
  res: Response,
  next: NextFunction
) => Promise<unknown>;

export function asyncHandler(handler: AsyncRequestHandler) {
  return async (req: Request, res: Response, next: NextFunction): Promise<void> => {
    try {
      await handler(req, res, next);
    } catch (error) {
      next(error);
    }
  };
}

// src/middleware/index.ts
export {
  errorHandler,
  requestId,
  requestContext,
  requestLogger,
  corsMiddleware,
  securityMiddleware,
  validateRequest,
  asyncHandler,
};

// src/domain/interfaces/repository.ts
export interface BaseRepository<T, K> {
  findById(id: K): Promise<T | null>;
  findAll(options?: QueryOptions): Promise<T[]>;
  create(data: Omit<T, 'id' | 'createdAt' | 'updatedAt'>): Promise<T>;
  update(id: K, data: Partial<T>): Promise<T>;
  delete(id: K): Promise<boolean>;
  count(filter?: FilterOptions): Promise<number>;
}

export interface QueryOptions {
  page?: number;
  limit?: number;
  sort?: SortOptions;
  filter?: FilterOptions;
  fields?: string[];
  includes?: string[];
}

export interface SortOptions {
  field: string;
  order: 'asc' | 'desc';
}

export interface FilterOptions {
  [key: string]: any;
}

// src/domain/entities/user.entity.ts
export interface User {
  id: string;
  email: string;
  username: string;
  password: string;
  role: UserRole;
  status: UserStatus;
  lastLoginAt?: Date;
  createdAt: Date;
  updatedAt: Date;
}

export enum UserRole {
  ADMIN = 'admin',
  USER = 'user',
}

export enum UserStatus {
  ACTIVE = 'active',
  INACTIVE = 'inactive',
  SUSPENDED = 'suspended',
}

// src/domain/entities/audit.entity.ts
export interface AuditLog {
  id: string;
  userId: string;
  action: string;
  resource: string;
  resourceId: string;
  oldValue?: unknown;
  newValue?: unknown;
  metadata?: Record<string, unknown>;
  createdAt: Date;
}

// src/db/schema/index.ts
import { pgTable, uuid, varchar, timestamp, text, jsonb } from 'drizzle-orm/pg-core';
import { createInsertSchema, createSelectSchema } from 'drizzle-zod';
import { UserRole, UserStatus } from '../../domain/entities/user.entity';

export const users = pgTable('users', {
  id: uuid('id').defaultRandom().primaryKey(),
  email: varchar('email', { length: 255 }).notNull().unique(),
  username: varchar('username', { length: 50 }).notNull(),
  password: text('password').notNull(),
  role: varchar('role', { length: 20 }).$type<UserRole>().notNull().default(UserRole.USER),
  status: varchar('status', { length: 20 }).$type<UserStatus>().notNull().default(UserStatus.ACTIVE),
  lastLoginAt: timestamp('last_login_at', { withTimezone: true }),
  createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
  updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),
});

export const auditLogs = pgTable('audit_logs', {
  id: uuid('id').defaultRandom().primaryKey(),
  userId: uuid('user_id').notNull().references(() => users.id),
  action: varchar('action', { length: 50 }).notNull(),
  resource: varchar('resource', { length: 50 }).notNull(),
  resourceId: varchar('resource_id', { length: 50 }).notNull(),
  oldValue: jsonb('old_value'),
  newValue: jsonb('new_value'),
  metadata: jsonb('metadata'),
  createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
});

export const refreshTokens = pgTable('refresh_tokens', {
  id: uuid('id').defaultRandom().primaryKey(),
  userId: uuid('user_id').notNull().references(() => users.id),
  token: text('token').notNull(),
  expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
  createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
});

// Zod schemas for validation
export const insertUserSchema = createInsertSchema(users, {
  email: (schema) => schema.email.email(),
  username: (schema) => schema.username.min(3).max(50),
  password: (schema) => schema.password.min(8).max(100),
  role: (schema) => schema.role.optional(),
});

export const updateUserSchema = createInsertSchema(users, {
  email: (schema) => schema.email.email().optional(),
  username: (schema) => schema.username.min(3).max(50).optional(),
  password: (schema) => schema.password.min(8).max(100).optional(),
  role: (schema) => schema.role.optional(),
  status: (schema) => schema.status.optional(),
}).pick({ email: true, username: true, status: true });

// src/repositories/base.repository.ts
import { eq, and, or, sql } from 'drizzle-orm';
import { PostgresJsDatabase } from 'drizzle-orm/postgres-js';
import { BaseRepository, QueryOptions, FilterOptions } from '../domain/interfaces/repository';

export abstract class Repository<T, K> implements BaseRepository<T, K> {
  constructor(
    protected readonly db: PostgresJsDatabase,
    protected readonly table: any
  ) {}

  protected abstract mapToEntity(record: any): T;

  async findById(id: K): Promise<T | null> {
    const result = await this.db.select().from(this.table).where(eq(this.table.id, id));
    return result[0] ? this.mapToEntity(result[0]) : null;
  }

  async findAll(options: QueryOptions = {}): Promise<T[]> {
    const { page = 1, limit = 10, sort, filter, fields } = options;
    const offset = (page - 1) * limit;

    let query = this.db.select().from(this.table);

    // Apply filters
    if (filter) {
      const conditions = Object.entries(filter).map(([key, value]) => {
        if (Array.isArray(value)) {
          return or(...value.map(v => eq(this.table[key], v)));
        }
        return eq(this.table[key], value);
      });
      query = query.where(and(...conditions));
    }

    // Apply sorting
    if (sort) {
      const { field, order } = sort;
      query = query.orderBy(order === 'desc' ? sql`${this.table[field]} DESC` : this.table[field]);
    }

    // Apply pagination
    query = query.limit(limit).offset(offset);

    const results = await query;
    return results.map(this.mapToEntity);
  }

  async create(data: Omit<T, 'id' | 'createdAt' | 'updatedAt'>): Promise<T> {
    const result = await this.db.insert(this.table).values(data).returning();
    return this.mapToEntity(result[0]);
  }

  async update(id: K, data: Partial<T>): Promise<T> {
    const result = await this.db
      .update(this.table)
      .set({ ...data, updatedAt: new Date() })
      .where(eq(this.table.id, id))
      .returning();
    return this.mapToEntity(result[0]);
  }

  async delete(id: K): Promise<boolean> {
    const result = await this.db
      .delete(this.table)
      .where(eq(this.table.id, id))
      .returning();
    return result.length > 0;
  }

  async count(filter?: FilterOptions): Promise<number> {
    let query = this.db.select({ count: sql<number>`count(*)` }).from(this.table);

    if (filter) {
      const conditions = Object.entries(filter).map(([key, value]) => {
        if (Array.isArray(value)) {
          return or(...value.map(v => eq(this.table[key], v)));
        }
        return eq(this.table[key], value);
      });
      query = query.where(and(...conditions));
    }

    const result = await query;
    return Number(result[0].count);
  }
}

// src/repositories/user.repository.ts
import { User } from '../domain/entities/user.entity';
import { users } from '../db/schema';
import { Repository } from './base.repository';
import { NotFoundError } from '../errors/application-errors';
import { db } from '../infrastructure/database';

export class UserRepository extends Repository<User, string> {
  constructor() {
    super(db, users);
  }

  protected mapToEntity(record: typeof users.$inferSelect): User {
    return {
      id: record.id,
      email: record.email,
      username: record.username,
      password: record.password,
      role: record.role,
      status: record.status,
      lastLoginAt: record.lastLoginAt || undefined,
      createdAt: record.createdAt,
      updatedAt: record.updatedAt,
    };
  }

  async findByEmail(email: string): Promise<User | null> {
    const result = await this.db
      .select()
      .from(users)
      .where(eq(users.email, email));
    return result[0] ? this.mapToEntity(result[0]) : null;
  }

  async findActive(): Promise<User[]> {
    const results = await this.db
      .select()
      .from(users)
      .where(eq(users.status, 'active'));
    return results.map(this.mapToEntity);
  }

  async updateLastLogin(id: string): Promise<void> {
    await this.db
      .update(users)
      .set({ lastLoginAt: new Date() })
      .where(eq(users.id, id));
  }
}

// src/repositories/audit.repository.ts
import { AuditLog } from '../domain/entities/audit.entity';
import { auditLogs } from '../db/schema';
import { Repository } from './base.repository';
import { db } from '../infrastructure/database';

export class AuditRepository extends Repository<AuditLog, string> {
  constructor() {
    super(db, auditLogs);
  }

  protected mapToEntity(record: typeof auditLogs.$inferSelect): AuditLog {
    return {
      id: record.id,
      userId: record.userId,
      action: record.action,
      resource: record.resource,
      resourceId: record.resourceId,
      oldValue: record.oldValue,
      newValue: record.newValue,
      metadata: record.metadata,
      createdAt: record.createdAt,
    };
  }

  async logChange(
    userId: string,
    action: string,
    resource: string,
    resourceId: string,
    oldValue?: unknown,
    newValue?: unknown,
    metadata?: Record<string, unknown>
  ): Promise<AuditLog> {
    return this.create({
      userId,
      action,
      resource,
      resourceId,
      oldValue,
      newValue,
      metadata,
    });
  }
}

// src/repositories/index.ts
export { UserRepository } from './user.repository';
export { AuditRepository } from './audit.repository';

// src/types/auth.ts
export interface TokenPayload {
  sub: string;  // user id
  role: string;
  permissions: string[];
  type: 'access' | 'refresh';
  jti: string;  // token id
}

export interface LoginResult {
  accessToken: string;
  refreshToken: string;
  user: {
    id: string;
    email: string;
    username: string;
    role: string;
  };
}

// src/domain/services/token.service.ts
import jwt from 'jsonwebtoken';
import { Redis } from 'ioredis';
import { v4 as uuidv4 } from 'uuid';
import { config } from '../../config';
import { TokenPayload } from '../../types/auth';
import { User } from '../entities/user.entity';

export class TokenService {
  constructor(private readonly redis: Redis) {}

  async generateTokens(user: User): Promise<{ accessToken: string; refreshToken: string }> {
    const accessTokenId = uuidv4();
    const refreshTokenId = uuidv4();

    const accessToken = await this.generateAccessToken(user, accessTokenId);
    const refreshToken = await this.generateRefreshToken(user, refreshTokenId);

    // Store token IDs in Redis for blacklisting
    await this.redis.setex(
      `token:access:${accessTokenId}`,
      config.auth.accessTokenTTL,
      user.id
    );
    await this.redis.setex(
      `token:refresh:${refreshTokenId}`,
      config.auth.refreshTokenTTL,
      user.id
    );

    return { accessToken, refreshToken };
  }

  private async generateAccessToken(user: User, tokenId: string): Promise<string> {
    const payload: TokenPayload = {
      sub: user.id,
      role: user.role,
      permissions: await this.getUserPermissions(user),
      type: 'access',
      jti: tokenId,
    };

    return jwt.sign(payload, config.auth.jwtSecret, {
      expiresIn: config.auth.jwtExpiresIn,
      algorithm: 'HS256',
    });
  }

  private async generateRefreshToken(user: User, tokenId: string): Promise<string> {
    const payload: TokenPayload = {
      sub: user.id,
      role: user.role,
      permissions: [],
      type: 'refresh',
      jti: tokenId,
    };

    return jwt.sign(payload, config.auth.jwtSecret, {
      expiresIn: config.auth.refreshTokenExpiresIn,
      algorithm: 'HS256',
    });
  }

  async verifyToken(token: string): Promise<TokenPayload> {
    const decoded = jwt.verify(token, config.auth.jwtSecret) as TokenPayload;

    // Check if token is blacklisted
    const isBlacklisted = await this.redis.exists(`token:blacklist:${decoded.jti}`);
    if (isBlacklisted) {
      throw new Error('Token has been revoked');
    }

    return decoded;
  }

  async revokeToken(tokenId: string): Promise<void> {
    // Add token to blacklist
    await this.redis.setex(
      `token:blacklist:${tokenId}`,
      config.auth.jwtExpiresIn,
      '1'
    );
  }

  async revokeAllUserTokens(userId: string): Promise<void> {
    const pattern = `token:*:${userId}`;
    const keys = await this.redis.keys(pattern);
    if (keys.length > 0) {
      await this.redis.del(...keys);
    }
  }

  private async getUserPermissions(user: User): Promise<string[]> {
    // 这里可以从数据库或配置中加载用户权限
    const rolePermissions: Record<string, string[]> = {
      admin: ['*'],
      user: ['read:own', 'write:own'],
    };
    
    return rolePermissions[user.role] || [];
  }
}

// src/services/auth.service.ts
import bcrypt from 'bcryptjs';
import { UserRepository } from '../repositories/user.repository';
import { TokenService } from '../domain/services/token.service';
import { LoginResult } from '../types/auth';
import { User, UserStatus } from '../domain/entities/user.entity';
import { 
  AuthenticationError, 
  ValidationError 
} from '../errors/application-errors';

export class AuthService {
  constructor(
    private readonly userRepository: UserRepository,
    private readonly tokenService: TokenService
  ) {}

  async login(email: string, password: string): Promise<LoginResult> {
    // Find user
    const user = await this.userRepository.findByEmail(email);
    if (!user) {
      throw new AuthenticationError('Invalid credentials');
    }

    // Check user status
    if (user.status !== UserStatus.ACTIVE) {
      throw new AuthenticationError('Account is not active');
    }

    // Verify password
    const isPasswordValid = await bcrypt.compare(password, user.password);
    if (!isPasswordValid) {
      throw new AuthenticationError('Invalid credentials');
    }

    // Generate tokens
    const { accessToken, refreshToken } = await this.tokenService.generateTokens(user);

    // Update last login
    await this.userRepository.updateLastLogin(user.id);

    return {
      accessToken,
      refreshToken,
      user: {
        id: user.id,
        email: user.email,
        username: user.username,
        role: user.role,
      },
    };
  }

  async register(userData: {
    email: string;
    username: string;
    password: string;
  }): Promise<User> {
    // Check if email already exists
    const existingUser = await this.userRepository.findByEmail(userData.email);
    if (existingUser) {
      throw new ValidationError('Email already exists');
    }

    // Hash password
    const hashedPassword = await bcrypt.hash(userData.password, 10);

    // Create user
    const user = await this.userRepository.create({
      ...userData,
      password: hashedPassword,
      role: 'user',
      status: UserStatus.ACTIVE,
    });

    return user;
  }

  async refreshToken(refreshToken: string): Promise<{ accessToken: string }> {
    // Verify refresh token
    const payload = await this.tokenService.verifyToken(refreshToken);
    if (payload.type !== 'refresh') {
      throw new AuthenticationError('Invalid token type');
    }

    // Get user
    const user = await this.userRepository.findById(payload.sub);
    if (!user || user.status !== UserStatus.ACTIVE) {
      throw new AuthenticationError('User not found or inactive');
    }

    // Generate new access token
    const { accessToken } = await this.tokenService.generateTokens(user);

    return { accessToken };
  }

  async logout(userId: string, tokenId: string): Promise<void> {
    await this.tokenService.revokeToken(tokenId);
  }

  async logoutAll(userId: string): Promise<void> {
    await this.tokenService.revokeAllUserTokens(userId);
  }
}

// src/middleware/auth.ts
import { Request, Response, NextFunction } from 'express';
import { TokenService } from '../domain/services/token.service';
import { AuthenticationError, AuthorizationError } from '../errors/application-errors';

export function authenticate(tokenService: TokenService) {
  return async (req: Request, res: Response, next: NextFunction): Promise<void> => {
    try {
      const authHeader = req.headers.authorization;
      if (!authHeader?.startsWith('Bearer ')) {
        throw new AuthenticationError('No token provided');
      }

      const token = authHeader.split(' ')[1];
      const payload = await tokenService.verifyToken(token);

      req.user = {
        id: payload.sub,
        role: payload.role,
        permissions: payload.permissions,
      };

      next();
    } catch (error) {
      next(new AuthenticationError('Invalid token'));
    }
  };
}

export function authorize(permissions: string | string[]) {
  return (req: Request, res: Response, next: NextFunction): void => {
    if (!req.user) {
      throw new AuthenticationError('User not authenticated');
    }

    const requiredPermissions = Array.isArray(permissions) ? permissions : [permissions];

    // Check if user has admin permissions
    if (req.user.permissions.includes('*')) {
      return next();
    }

    // Check specific permissions
    const hasPermission = requiredPermissions.every(permission =>
      req.user!.permissions.includes(permission)
    );

    if (!hasPermission) {
      throw new AuthorizationError('Insufficient permissions');
    }

    next();
  };
}

// src/middleware/ownership.ts
export function checkOwnership(resourceKey: string = 'id') {
  return (req: Request, res: Response, next: NextFunction): void => {
    if (!req.user) {
      throw new AuthenticationError('User not authenticated');
    }

    const resourceId = req.params[resourceKey];
    
    // Admins can access all resources
    if (req.user.role === 'admin') {
      return next();
    }

    // Users can only access their own resources
    if (resourceId !== req.user.id) {
      throw new AuthorizationError('Access denied');
    }

    next();
  };
}